CVE-2025-2907
CRITICAL EXPLOITED NUCLEIOrder Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update
Title source: nucleiExploitation Summary
CVE-2025-2907 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Yucaerin. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets a missing authorization vulnerability in the Order Delivery Date for WooCommerce plugin, allowing unauthenticated attackers to modify WordPress site options. It automates the process of enabling user registration and setting the default role to administrator, leading to privilege escalation.
Description
The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing settings. Furthermore it also lacks proper checks to only update options relevant to the Order Delivery Date WordPress plugin before 12.3.1. This leads to attackers being able to modify the default_user_role to administrator and users_can_register, allowing them to register as an administrator of the site for complete site takeover.
Exploits (1)
This exploit targets a missing authorization vulnerability in the Order Delivery Date for WooCommerce plugin, allowing unauthenticated attackers to modify WordPress site options. It automates the process of enabling user registration and setting the default role to administrator, leading to privilege escalation.
Nuclei Templates (1)
body="wp-content/plugins/order-delivery-date-for-woocommerce"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H